Active Storage

2026-07-308 minAkamaicritical

CVE-2026-66066 is a critical (CVSS 9.5) pre-auth remote code execution vulnerability in Ruby on Rails Active Storage, which uses libvips as its default image processor since Rails 7.0. An unauthenticated attacker can upload a specially crafted image that triggers unsafe libvips operations, enabling arbitrary file reads — most critically the application's secretkeybase and other environment secrets. With the secretkeybase compromised, the attacker can forge session cookies and achieve full RCE on the server. Immediate patching of Rails and libvips, along with rotation of all application secrets, is required.